Multi-assessment Analysis Guide v

Transcription

1 Multi-assessment Analysis Guide v

2 Introduction The Multi-assessment Analysis function provides users a streamlined method to perform side-by-side comparisons of two or more assessments. This feature can be used for several different analytical actions, such as trend analysis of a particular organization over time, cross-cutting analysis of organizations within a command, and discrete asset or threat analysis of an AOR. This guide will provide users with an understanding of the features available for Multiassessment Analysis. 2

3 Beginning the Process on the Homepage Open the EPRM program. Select Analyze Assessments from the dashboard to open the assessment selection grid page. On the dashboard, click on the Analyze Assessments button. Unlike selecting an assessment to open, users should NOT click on the assessment(s) targeted for the analysis. That selection will be made on subsequent pages. 3

4 Select Assessments for Analysis The grid which opens displays all of the assessments available for inclusion is now open to allow you to select the assessments that you wish to include in the analysis. After identifying all the assessments to be included, click continue to move forward with your study. Select the assessments that you wish to use in the analysis. Note that to perform multiassessment analysis, you must select at least two assessments. Otherwise this error message will appear. If you plan to include all assessments, use this box. Click continue when all desired assessments have been selected. 4

5 Multi-assessment Overview After selecting the desired assessments and continuing the process, the page displayed will open, providing a top level overview of the compiled assessment data. A single visual roll-up of the Countermeasure/benchmark status across the assessments. To download this graphic, follow these instructions. Clicking either, Take a Deeper Look, or, Continue, will move you to the next level of analysis. As a point of reference, the Risk calculation is shown here. 5

6 Multi-assessment Visualization The Analysis Detail, or, Deeper Look page presents an array of features that allow users to view a detailed breakdown of the assessment data. Users can view charts depicting various grids, reports, and aggregated percentages for risk levels. On the following pages these features will be broken down and explained. This area includes another overall (roll-up) pie chart, and buttons that take the user to other features. These Barchart fields display Risk in relation to each of the variables vulnerability, threat and assets. The displayed pie chart can be downloaded from here as well as on the preceding page. 6

7 Multi-assessment Visualization Risk Scenarios Clicking on the Risk Scenarios button opens a new page that graphically displays Risk by each asset-threat-vulnerability calculation. (T S x T M ) V A Calculated Risk. Each line shows a risk scenario, i.e., R = A x (T S x T M ) x V. Every pairing is displayed and can be sorted or filtered to display the user s desired data. 7

8 Multi-assessment Visualization Reports Clicking on the Reports button, opens a page with a listing of available reports. Click on a hyperlink to open the selected report to open in Excel or Word. As the tool matures, additional reports in Word and Excel will be added to this display/menu. Click this hyperlink to open an Excel file with multiple data sheets. 8

9 Multi-assessment Visualization Reports (cont d) Clicking the hyperlink opens an Excel file. This file opens to an information cover that details the assessments included in the analysis. Note the tabs at the bottom of the page. Blue tabs indicate user input data and Green indicate calculated data generated by the tool. The data arrays (shown in subsequent pages) are not finished reports, but source material for users to integrate into reports as desired. Blue tabs compare Assessment input, such as all Benchmarks implemented. Green tabs show compiled data for each Assessment by Risk pairings. 9

10 Multi-assessment Visualization Asset Input Report Clicking through the tabs, Asset Criticality Input opens the sheet shown below, which lists units on the x-axis and assets on the y-axis. This sheet provides a visualization of the side-by-side comparison of criticality values for each asset by organization or unit. Organization/ units Legend Click here for Asset Criticality table. Assets Criticality 10

11 Multi-assessment Visualization Threat Input Report Continuing through the tabs, Threat Characterization Input opens the sheet shown below, which lists units on the x-axis and threats on the y-axis. This sheet provides a visualization of the side-by-side comparison of source and method values for each threat by organization or unit. Organization/ units Legend Click here for Threat table. Threats Values 11

12 Multi-assessment Visualization CM Status Report Finishing the Blue (Input) tabs, Countermeasure Input opens the sheet shown below, which lists units on the x-axis and Countermeasures on the y-axis. This sheet provides a side-by-side comparison by countermeasure implementation of each organization or unit. Organization/ units Legend CM roll-up All Countermeasures Click here for Countermeasure table. CM Responses 12

13 Multi-assessment Visualization (R by T M ) Report Moving to the Green (calculated data) tabs, Risk by Threat Method opens the sheet shown below, which uses a graph rather than a table format to display data. In addition to the graph, it and subsequent Green tabs include a written explanation, and the numerical data in a table to the left of the graph. Explanation Numerical data Click here for Risk by Threat Method data. Increasing bar size indicates increasing risk relative to the other risk methods for these units, not necessarily a great overall risk. 13

14 Multi-assessment Visualization (R by T S ) Report Continuing with the Green (calculated data) tabs, Risk by Threat source opens the sheet shown below. Here the threat source, or, threat actors are displayed in the bars of the graph. Again, it includes a written explanation, and the numerical data in a table to the left of the graph. Explanation Numerical data Increasing bar size indicates increasing risk relative to the sources of risk for these units, not necessarily a great overall risk. Click here for Risk by Threat Sources data. 14

15 Multi-assessment Visualization (R by A) Report Continuing with the Green (calculated data) tabs, Risk by Asset Type opens the sheet shown below. Here the particular assets that are at risk are displayed in the bars of the graph. Again, it includes a written explanation, and the raw data in a table to the left of the graph. Explanation Numerical data Increasing bar size indicates increasing risk relative to the Assets within these units. Click here for Risk by Asset data. 15

16 Multi-assessment Visualization (R by Unit) Report The final Green (calculated data) tab, Risk by Assessment opens the sheet shown below. Here the individual assessments relative aggregate risk is represented by the bars of the graph. This graph displays horizontally, rather than vertically as the previous displays have done. This allows users to read a list of units down the left side of the graphic and allows an easier recognition of unit risk comparisons. The other features remain the same, a brief explanation and a table of numerical values. Explanation Numerical data Click here for Risk by Asset data. 16

17 Multi-assessment Visualization Assign and Track After viewing all of the report pages, and returning to the Analysis Detail page, there is one last button on the left, the Assign and Track button. This is an administrative feature rather than a data presentation. It allows users to view items that have been assigned/tasked for implementation. Click here to open the Assign and Task grid page. 17

18 Multi-assessment Visualization Assign and Track The Action Items listing displays those Countermeasures that were not implemented at the time of the assessment, but were assigned to an individual for implementation. It provides the status, POC, CM, and dates due and completed for tracking purposes. This is read only and not a point to close out listed actions, or assign other actions. Individual assigned responsibility for this action CM for implementation Dates when due and when completed 18

19 Multi-assessment Visualization Bar Charts Moving now to the right side of the page, there are three bar chart frames. These depict up to five items in each bar chart corresponding to the top risk scored items for Vulnerabilities, Threats, and Assets respectively. Mouse over each bar to display the item label. Additional data views can be displayed by clicking on the View Details button, and by clicking on the bar chart. 19

20 Multi-assessment Visualization Bar Chats (cont d) There are three methods of viewing data in the bar chart boxes as shown on the previous page. In order to demonstrate the data displays look at the Assets box. The first two are shown here. Mouse over displays a label and a numerical value. The value is not a score, but an internal relative scaling number for the chart. In the future it will be removed. The mouse over feature works the same here. To download this graphic, click anywhere in the chart. 20

21 Multi-assessment Visualization Bar Chats (cont d) The final data display comes from clicking the View Details button under the bar graph. This opens another page with all, not just the top five, assets displayed at the aggregate level. The individual assessment data can also be accessed as shown. The other two bar chart frames will display the data represented there in the same way. Click the + to display the individual Assets score by assessment Click the button to display the aggregated Assets 21

22 Conclusion The Multi-assessment Analysis function provides users a streamlined method to perform side-by-side comparisons of two or more assessments. This lesson walks users through the features available in this functional area of the EPRM Tool. For further assistance or for any questions, please EPRMhelp@alionscience.com or call Eastern time 22